If you find a vulnerability or security issue, please send an email to [email protected]. You can also use PGP to protect the confidentiality of your email. The public key is here.
Do not submit them to public issues or demonstration code as pull-requests.
More information: https://pepabo.com/contact/vulnerability_reporting/